Olson & White Orthodontics

On July 22, 2013, two desktop computers that contained protected health information (PHI) were stolen from the covered entity (CE), Olson & White Orthodontics, during a break-in. The names, addresses, dates of birth, social security numbers, claims information, diagnoses, and treatment information affecting 10,000 were reportedly disclosed. The CE utilized a system for encryption to protect its PHI; however, a software oversight may have resulted in some PHI being stored in an unencrypted manner on the stolen computers. The CE provided breach notification to HHS, affected individuals, and the media and posted substitute notice on its website. Following the breach, the CE reported the theft to the proper authorities, added offsite data backup storage, and improved physical safeguards. Additionally, it retrained staff and eliminating office procedures that resulted in the storage of unencrypted PHI. As a result of OCR’s investigation, the CE updated its uses and disclosures policy and provided training on the updated policy. The CE also provided OCR documentation of its corrective actions.